Router – Two routers sharing internet but isolated from each other

1. Not really

2. DNS right? If 192.168.2.2 is your internal DHCP(Windows AD DC, I'm assuming), then you'll configure that to push out whatever DNS server you want, the same pc, 192.168.2.2 if you're running DNS on it also.

3. No. The stuff on the verizon router is "on the internet" as far as the stuff behind the netgear is concerned. The only incoming traffic allow will be what you define in the Netgear, ie. Portforwarding.

4. Yes

5. PC's behind the Netgear will "just work". I'm a little confused, You want wireless clients to connect to the Verizon router, and you want don't want them to have access to the LAN, right? Don't you want them to just get an address from the VZ router, and not from an internal DHCP server?

6. Yes. If it's actually a WAP, it probably doesn't have a DHCP server, it's just like a switch but without the...wires. You can use a consumer wireless, turn off the DHCP server, and don't even bother with the WAN port.

The main thing is 5 about DHCP. You'd have to set up portfowarding to get DHCP to assign through the Netgear, but I don't think you want to do that. You just want them to get DHCP from the VZ router right?

I hope this makes sense

You are right to not want to run multiple DHCP servers on the same network, that can end up giving very random results.

Right now it sounds like you have both wireless routers plugged into your main router by their internal ports, using them basically as access points instead of routers (just getting the wireless users connected into the main network and letting the main router do the real thinking).

If the wireless router the students are on allows you to setup your port blocking rules to specific addresses, you may be able to on that one set it to block all communication, then allow specific rules to your internal servers. Then connect that router to your main network by the Internet/WAN port on the router and enable DHCP on it. That will make it so that the students are segmented on their own network and can only access your main network routing through the wireless router, which has the rules setup on it.

So, you would have:
Internet Connection <-> Main Router WAN Port
Main Router Internal Port <-> Teacher Wireless Router Internal Port
Main Router Internal Port <-> Student Wireless Router WAN Port

Anyone connected to the main router or the teacher wireless will be in one network and have normal access. Anyone connected to the student wireless will be in another network behind the student wireless router and be subjected to the rules setup on that router.

Otherwise, you'd want to look into setting up a DMZ to separate the students from everyone else, then setup your specific rules they are allowed to do. Your current equipment may not support this, your main wired router would be the one to look at.